linux-kernel - Re: [PATCH] tracing: separate raw syscall from syscall tracer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 25 Nov 2009 10:08:14 +0800
From:	Lai Jiangshan <laijs@...fujitsu.com>
To:	Steven Rostedt <rostedt@...dmis.org>
CC:	Frederic Weisbecker <fweisbec@...il.com>,
	Ingo Molnar <mingo@...e.hu>, Jason Baron <jbaron@...hat.com>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] tracing: separate raw syscall from syscall tracer

Frederic Weisbecker wrote:
> On Tue, Nov 03, 2009 at 01:45:32PM +0800, Lai Jiangshan wrote:
>> current syscall tracer mixes raw syscalls and real syscalls.
>>
>> echo 1 > events/syscalls/enable
>> And we get these from the output:
>>
>> (XXXX insteads "            grep-20914 [001] 588211.446347" .. etc)
>>
>> XXXX: sys_read(fd: 3, buf: 80609a8, count: 7000)
>> XXXX: sys_enter: NR 3 (3, 80609a8, 7000, a, 1000, bfce8ef8)
>> XXXX: sys_read -> 0x138
>> XXXX: sys_exit: NR 3 = 312
>> XXXX: sys_read(fd: 3, buf: 8060ae0, count: 7000)
>> XXXX: sys_enter: NR 3 (3, 8060ae0, 7000, a, 1000, bfce8ef8)
>> XXXX: sys_read -> 0x138
>> XXXX: sys_exit: NR 3 = 312
>>
>> There are 2 drawbacks here.
>> A) two almost identical records are saved in ringbuffer
>>    when a syscall enters or exits. (4 records for every syscall)
>>    it wastes too much.
>> B) the lines include "sys_enter/sys_exit" makes
>>    we hardly get the useful information for the output.
>>
>> The user can use this method to prevent these drawbacks:
>> echo 1 > events/syscalls/enable
>> echo 0 > events/syscalls/sys_enter/enable
>> echo 0 > events/syscalls/sys_exit/enable
>>
>> But it's not friendly for users. So we separate raw syscall
>> from syscall tracer.
>>
>> After this fix applied:
>> syscall tracer's output (echo 1 > events/syscalls/enable):
>>
>> XXXX: sys_read(fd: 3, buf: bfe87d88, count: 200)
>> XXXX: sys_read -> 0x200
>> XXXX: sys_fstat64(fd: 3, statbuf: bfe87c98)
>> XXXX: sys_fstat64 -> 0x0
>> XXXX: sys_close(fd: 3)
>>
>> raw syscall tracer's output (echo 1 > events/raw_syscalls/enable):
>>
>> XXXX: sys_enter: NR 175 (0, bf92bf18, bf92bf98, 8, b748cff4, bf92bef8)
>> XXXX: sys_exit: NR 175 = 0
>> XXXX: sys_enter: NR 175 (2, bf92bf98, 0, 8, b748cff4, bf92bef8)
>> XXXX: sys_exit: NR 175 = 0
>> XXXX: sys_enter: NR 3 (9, bf927f9c, 4000, b77e2518, b77dce60, bf92bff8)
>>
>> Signed-off-by: Lai Jiangshan <laijs@...fujitsu.com>
>> ---
> 
> 
> Agreed, that's indeed not convenient.
> 
> Acked-by: Frederic Weisbecker <fweisbec@...il.com>
> 
> 
> 

Hi, Steven

Could you accept this patch?

Lai
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/